Skip to content

deps: Bump the dependencies group with 5 updates - #107

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/dependencies-9c3a871f37
Open

deps: Bump the dependencies group with 5 updates#107
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/dependencies-9c3a871f37

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 11, 2026

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 5 updates:

Package From To
anthropic 1.8.0 1.11.0
torch 2.14.0 2.14.1
transformers 5.17.0 5.18.0
ruff 0.16.9 0.16.10
mypy 2.3.1 2.4.0

Updates anthropic from 1.8.0 to 1.11.0

Release notes

Sourced from anthropic's releases.

v1.11.0

1.11.0 (2026-09-30)

Full Changelog: v1.10.0...v1.11.0

Features

  • api: add list spend limits endpoint (e8f0cac)

Chores

  • client: deprecate sonnet 4.5 (22b36b1)

v1.10.0

1.10.0 (2026-09-30)

Full Changelog: v1.9.0...v1.10.0

Features

  • api: add a refusal stop reason and stop_details to Managed Agents session idle events (cba653f)
  • api: add Claude Enterprise analytics, spend limits, and RBAC groups and roles to the Admin API (6bb2c0c)
  • api: add per-user usage and cost reports to the Admin API analytics (7443920)
  • api: add Plugins and Plugin Marketplaces to the Admin API (1baad3b)
  • api: add repository error types to Managed Agents session errors (c682f7e)
  • api: allow removing a plugin's org-wide installation setting (17f52fc)
  • api: MCP tunnels beta: add read-only transport object to Tunnel and return the one-time relay token in the create response (88718ff)
  • api: Organization API endpoints are now GA (f1d195a)

Bug Fixes

  • api: make memory store description, metadata, archived_at required (6cc39d3)
  • api: type admin plugin preference and marketplace fields as enums (b4dfd99)
  • credentials: refuse config files that group or others can write (cd5fc6a)
  • pagination: auto-paging continues past an empty page while next_page is set (c027a26)
  • tools: stop the session tool runner after any idle that ends the turn (#969) (9c60a53)

Chores

  • api: update MCP Tunnels types and descriptions (aa49ba7)
  • ci: run tests on the oldest and newest Python in parallel (53bb298)
  • docs: remove placeholder enum descriptions (f535d67)
  • internal: format request options with one argument per line (4e2463e)
  • tests: match mocked binary routes when a request adds query params (0781470)

v1.9.0

1.9.0 (2026-09-28)

... (truncated)

Changelog

Sourced from anthropic's changelog.

1.11.0 (2026-09-30)

Full Changelog: v1.10.0...v1.11.0

Features

  • api: add list spend limits endpoint (e8f0cac)

Chores

  • client: deprecate sonnet 4.5 (22b36b1)

1.10.0 (2026-09-30)

Full Changelog: v1.9.0...v1.10.0

Features

  • api: add a refusal stop reason and stop_details to Managed Agents session idle events (cba653f)
  • api: add Claude Enterprise analytics, spend limits, and RBAC groups and roles to the Admin API (6bb2c0c)
  • api: add per-user usage and cost reports to the Admin API analytics (7443920)
  • api: add Plugins and Plugin Marketplaces to the Admin API (1baad3b)
  • api: add repository error types to Managed Agents session errors (c682f7e)
  • api: allow removing a plugin's org-wide installation setting (17f52fc)
  • api: MCP tunnels beta: add read-only transport object to Tunnel and return the one-time relay token in the create response (88718ff)
  • api: Organization API endpoints are now GA (f1d195a)

Bug Fixes

  • api: make memory store description, metadata, archived_at required (6cc39d3)
  • api: type admin plugin preference and marketplace fields as enums (b4dfd99)
  • credentials: refuse config files that group or others can write (cd5fc6a)
  • pagination: auto-paging continues past an empty page while next_page is set (c027a26)
  • tools: stop the session tool runner after any idle that ends the turn (#969) (9c60a53)

Chores

  • api: update MCP Tunnels types and descriptions (aa49ba7)
  • ci: run tests on the oldest and newest Python in parallel (53bb298)
  • docs: remove placeholder enum descriptions (f535d67)
  • internal: format request options with one argument per line (4e2463e)
  • tests: match mocked binary routes when a request adds query params (0781470)

1.9.0 (2026-09-28)

Full Changelog: v1.8.0...v1.9.0

... (truncated)

Commits
  • 18f2554 Merge pull request #1966 from anthropics/release-please--branches--main--chan...
  • 381f5f3 release: 1.11.0
  • 15fb0f3 codegen metadata
  • 22b36b1 chore(client): deprecate sonnet 4.5
  • e8f0cac feat(api): add list spend limits endpoint
  • 0f7f9f9 Merge branch 'main' into next
  • 6c3e94b Merge pull request #1965 from anthropics/release-please--branches--main--chan...
  • d226754 release: 1.10.0
  • 9c60a53 fix(tools): stop the session tool runner after any idle that ends the turn (#...
  • 7443920 feat(api): add per-user usage and cost reports to the Admin API analytics
  • Additional commits viewable in compare view

Updates torch from 2.14.0 to 2.14.1

Release notes

Sourced from torch's releases.

PyTorch 2.14.1 Release

This release is meant to fix the following regressions and silent correctness issues:

Silent correctness fixes

  • Fix incorrect torch.linalg.lstsq solutions on MPS for complex batched underdetermined systems (#196113), fixed by #196128
  • Fix non-orthogonal U and inaccurate small singular values from torch.linalg.svd on MPS for rank-deficient and ill-conditioned inputs (#196112), fixed by #196139 and #199063
  • Update the CUDA 13.2 Linux binaries to CUDA 13.2.2 (#196351). This NVIDIA update resolves two critical issues that could produce incorrect results (CUDA 13.2.2 release notes):
    • cuBLAS: cublasLtMatmul() could ignore tensor-wide scaling for NVFP4 matrix multiplications (introduced in CUDA 13.2 Update 1)
    • Compiler: failed thread reconvergence could leave stale or corrupted register values in kernels with nested thread divergence (present since CUDA 12.8)

Regression fixes

  • Fix torch.linalg.svd, torch.linalg.svdvals and torch.linalg.lstsq failing on MPS with a Metal pipeline-state error for inputs above 8192 elements (#195937), fixed by #195949 and #195950
  • Fix internal assert in torch.svd(out=) on MPS for complex inputs (#195822), fixed by #195872
Commits
  • 5c48869 [MPS] Fix Jacobi SVD convergence for small columns (#199086)
  • 35223a2 [release/2.14] Run the release runner-group reconcile in pytorch/pytorch (#19...
  • 41ffbc4 [release-only] Update version to 2.14.1 (#198661)
  • e8f0c01 [release/2.14] [CD] Update to CUDA 13.2.2 for Linux binaries (#198644)
  • 911665d [MPS] Cherry-pick native SVD fixes into release/2.14 (#198394)
  • See full diff in compare view

Updates transformers from 5.17.0 to 5.18.0

Release notes

Sourced from transformers's releases.

Release 5.18.0

New Model additions

Nemotron 3 Diarization

Nemotron 3 Diarization is an open-weight streaming speaker diarization model designed to determine "who spoke when" in real-world audio. It supports both streaming and offline inference, handles up to eight speakers, and orders speaker outputs by each speaker's first arrival in the input audio.

The model uses the Arrival-Order Speaker Cache (AOSC) 1 and FIFO queue introduced for Streaming Sortformer 1, 2. A single checkpoint supports configurable latency profiles, from an 80 ms input buffer to a 30.4 s offline-style buffer, and configurable output frame resolution in multiples of 10 ms. With chunked inference, the maximum audio duration is not limited.

Links: Documentation

NemotronH Omni

NemotronH Omni is a multimodal reasoning model from NVIDIA that pairs the NemotronH hybrid Mamba-Transformer language model with a RADIO vision encoder and an optional Parakeet-based sound encoder. Image (and video) patches are projected through a RADIO tower and a pixel-shuffle MLP into the language model's embedding space at the <image> / <video> context-token positions; audio clips are projected in the same way at <audio> positions. The result is a single autoregressive model that reasons jointly over text, images, video and sound.

Links: Documentation

HyperCLOVAX Vision V2

HyperCLOVAX Vision V2 is a multimodal vision-language model developed by NAVER. It combines the HyperClovaX language model backbone with a Qwen2.5-VL vision encoder. The model supports text, image, and video inputs and is capable of chain-of-thought reasoning via built-in thinking tokens (<think>...</think>).

Links: Documentation

GTE

GTE was proposed in mGTE: Generalized Long-Context Text Representation and Reranking Models for Multilingual Text Retrieval by Xin Zhang, Yanzhao Zhang, Dingkun Long, Wen Xie, Ziqi Dai, Jialong Tang, Huan Lin, Baosong Yang, Pengjun Xie, Fei Huang, Meishan Zhang, Wenjie Li and Min Zhang.

GTE is a BERT-style bidirectional encoder that replaces absolute position embeddings with RoPE, uses a gated MLP, and applies layer normalization after each residual connection. The same architecture backs Alibaba's gte-*-v1.5, gte-multilingual-* and gte-en-mlm-* checkpoints as well as Snowflake's snowflake-arctic-embed-m-v2.0.

Links: Documentation

Breaking changes

... (truncated)

Commits
  • a906d3c v5.18.0
  • 57296d1 model: Add GTE to Transformers (#48416)
  • 88536f2 [Nemotron3Diarization] fix streaming last stft frame dropped (#49167)
  • 5cd2877 Fix missing router_logits in Qwen3.5-MoE and other MoE models (#49179)
  • 4fcb1ff Fix MiniMax M3 partial 3D vision rotary embeddings (#49164)
  • 8520b15 Add Strix Halo (gfx1151) Atlas Inference Hub-kernel path for Qwen3.5/3.6/3.8 ...
  • a877116 Fix MPS GQA version gating (#49210)
  • e0299e2 Fix additional_special_tokens data loss with extra_special_tokens (#47848)
  • 5aab642 Fix stale _added_tokens_encoder entries in cpmant and wav2vec2 (#47440)
  • 0c18a63 Fix deepstack features for mixed-input (#49177)
  • Additional commits viewable in compare view

Updates ruff from 0.16.9 to 0.16.10

Release notes

Sourced from ruff's releases.

0.16.10

Release Notes

Released on 2026-10-01.

Preview features

  • Add a migration guide for categories (#28087)
  • [pyupgrade] Add rule for context manager iterator annotations (UP052) (#29000)

Performance

  • Reduce memory used by diagnostics (#28951)

Server

  • Avoid running uv format in untrusted workspaces (#28873)

Documentation

  • Fix links to moved changelog sections and renamed mdtests (#28941)
  • Add Python 3.15 as a supported version (#28907)
  • Add ty as a type checker example (#28906)

Other changes

  • Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)

Contributors

Install ruff 0.16.10

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.10/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.10/ruff-installer.ps1 | iex"

Download ruff 0.16.10

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.10

Released on 2026-10-01.

Preview features

  • Add a migration guide for categories (#28087)
  • [pyupgrade] Add rule for context manager iterator annotations (UP052) (#29000)

Performance

  • Reduce memory used by diagnostics (#28951)

Server

  • Avoid running uv format in untrusted workspaces (#28873)

Documentation

  • Fix links to moved changelog sections and renamed mdtests (#28941)
  • Add Python 3.15 as a supported version (#28907)
  • Add ty as a type checker example (#28906)

Other changes

  • Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)

Contributors

Commits
  • 3265ed1 Bump version to 0.16.10 (#29055)
  • e786964 Authorize shared PR security-review workflow to publish findings (#29052)
  • a81291e [ty] Defer uv workspace discovery until after project configuration (#28525)
  • b6a74d2 [ty] Refresh uv project metadata when uv files change (#28529)
  • 41d30df Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)
  • 317e0a3 [ty] Bound nested callable signature display (#29049)
  • 8546752 [ty] Fix member lookup on union-bounded type variables (#29018)
  • 56180bc [ty] Specialize instance members once (#29043)
  • aa9a1ff [ty] Avoid stale I/O diagnostics when closing deleted files (#28988)
  • 2d25346 [ty] Improve unresolved-import documentation (#29039)
  • Additional commits viewable in compare view

Updates mypy from 2.3.1 to 2.4.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Mypy 2.4

We've just uploaded mypy 2.4.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Python 3.15 Support

Mypy 2.4 supports running on Python 3.15 and type checking most Python 3.15 features. This includes the new builtin sentinel type for sentinel values (PEP 661), which mypy now supports (see below for details). Lazy imports (PEP 810) and unpacking in comprehensions (PEP 798) are also supported. Closed TypedDicts (PEP 728) have been supported since mypy 2.2, but the extra_items TypedDict argument, also introduced in PEP 728, is still unsupported. Support for extra_items will be added in a future mypy release.

Native Parser Enabled by Default

Mypy now uses the new native parser by default. It's based on the Ruff parser, and it's significantly faster than the legacy parser, which uses the stdlib ast module. The native parser also has other benefits:

  • You can target newer Python versions and use recent Python syntax even when running mypy on an older Python version. For example, you can use --python-version 3.15 when running mypy on Python 3.14.
  • Stub files can use syntax that is newer than the target Python version. For example, stubs can use the PEP 695 generic class syntax (class Box[T]: ...) when running on or targeting Python 3.10.
  • Parallel type checking requires the native parser.

The legacy parser is still available through --no-native-parser, or native_parser = False in the config file (native_parser = false under [tool.mypy] in pyproject.toml). We are planning to remove the legacy parser in early 2027. If you run into a problem with the native parser, please report it on the issue tracker.

Unlike the legacy parser, the native parser doesn't support type comments for variables defined by for and with statements. These type comments are silently ignored, and the types of the variables are

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps: Bump the dependencies group with 5 updates
ec7a6c7 
Bumps the dependencies group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [anthropic](https://github.com/anthropics/anthropic-sdk-python) | `1.8.0` | `1.11.0` |
| [torch](https://github.com/pytorch/pytorch) | `2.14.0` | `2.14.1` |
| [transformers](https://github.com/huggingface/transformers) | `5.17.0` | `5.18.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.9` | `0.16.10` |
| [mypy](https://github.com/python/mypy) | `2.3.1` | `2.4.0` |


Updates `anthropic` from 1.8.0 to 1.11.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-python@v1.8.0...v1.11.0)

Updates `torch` from 2.14.0 to 2.14.1
- [Release notes](https://github.com/pytorch/pytorch/releases)
- [Changelog](https://github.com/pytorch/pytorch/blob/main/RELEASE.md)
- [Commits](pytorch/pytorch@v2.14.0...v2.14.1)

Updates `transformers` from 5.17.0 to 5.18.0
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.17.0...v5.18.0)

Updates `ruff` from 0.16.9 to 0.16.10
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/0.16.10/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.9...0.16.10)

Updates `mypy` from 2.3.1 to 2.4.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.1...v2.4.0)

---
updated-dependencies:
- dependency-name: anthropic
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: torch
  dependency-version: 2.14.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: transformers
  dependency-version: 5.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: ruff
  dependency-version: 0.16.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: mypy
  dependency-version: 2.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 11, 2026
@socket-security

socket-security Bot commented Oct 11, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedtorch@​2.14.0 ⏵ 2.14.17310010010070
Updatedmypy@​2.3.1 ⏵ 2.4.075 +1100100100100
Updatedtransformers@​5.17.0 ⏵ 5.18.077 +1100100100100
Updatedanthropic@​1.8.0 ⏵ 1.11.087 +1100100100100
Updatedruff@​0.16.9 ⏵ 0.16.10100100100100100

View full report

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants